What is the CVSS score of CVE-2025-36631?

CVE-2025-36631 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-36631?

Tenable Agent for Windows versions before 10.8.5 contain a privilege escalation vulnerability (CVSS 8.4) that allows non-administrative users to write arbitrary files with SYSTEM-level privileges,…. A patch is available.

How to fix or mitigate CVE-2025-36631?

Within 24 hours: Inventory all Windows systems running Tenable Agent and identify those on versions prior to 10.8.5 using your asset management system. Within 7 days: Deploy Tenable Agent version 10.8.5 or later to all affected Windows endpoints through your patch management platform, prioritizing systems with sensitive data or administrative functions. Within 30 days: Verify patch deployment completion across all Windows systems and validate agent version compliance through Tenable's agent management console.

Windows CVE-2025-36631

EUVD-2025-18277 HIGH

Improper Privilege Management (CWE-269)

2025-06-13 vulnreport@tenable.com

Windows Information Disclosure Microsoft Nessus Agent Tenable

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:39 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.8.5

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18277

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 15:15 nvd

HIGH 8.4

DescriptionCVE.org

In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.

AnalysisAI

Privilege escalation vulnerability in Tenable Agent for Windows (versions prior to 10.8.5) that allows non-administrative users to overwrite arbitrary system files with log content while executing at SYSTEM privilege level. This vulnerability enables local attackers without admin rights to achieve arbitrary file write operations with elevated privileges, potentially leading to system compromise. The vulnerability has a CVSS score of 8.4 (High) and affects Windows deployments; patch availability exists in version 10.8.5 and later.

Technical ContextAI

This vulnerability stems from improper privilege management (CWE-269: Improper Access Control) in the Tenable Agent's logging mechanism on Windows platforms. The root cause involves the agent's log writing functionality failing to properly validate file paths or implement appropriate access controls when writing logs with elevated SYSTEM privileges. A non-administrative user can leverage this flaw to redirect or manipulate log output paths, causing arbitrary files on the system to be overwritten with log content while the write operation executes under SYSTEM context. The affected component is the Tenable Agent service running on Windows (CPE likely matching: cpe:2.3:a:tenable:tenable_agent:*:*:*:*:*:windows:*:*). The vulnerability exploits the trust boundary between user-mode code and privileged system operations without sufficient path validation or sandboxing.

RemediationAI

Immediate action: Upgrade Tenable Agent to version 10.8.5 or later on all affected Windows systems. Step-by-step remediation: (1) Identify all Windows endpoints running Tenable Agent versions prior to 10.8.5 using asset inventory or Tenable's own scanning tools; (2) Schedule maintenance windows for patching; (3) Download Tenable Agent 10.8.5+ from Tenable's official release repository; (4) Deploy via group policy, endpoint management tools (SCCM, Intune), or manual update; (5) Verify upgrade completion and agent health post-deployment. Interim mitigations (pre-patch): (1) Restrict local user account creation on Windows systems running Tenable Agent to trusted personnel only; (2) Disable or remove unnecessary local user accounts; (3) Monitor for suspicious log file modifications using Windows Auditing (enable object access auditing for sensitive system files); (4) Implement file integrity monitoring (FIM) solutions to detect unauthorized file changes. Vendor advisory and patch availability: Consult Tenable's official security advisory at https://www.tenable.com/security-advisories or contact Tenable support for the latest patch links and deployment guidance.